What happened
On June 25, 2026, an attacker exploited a double-spend bug in the Nomic chain's custom nBTC forwarding logic, minting 40.650602 nBTC on Osmosis with no bitcoin behind it. Of that, 39.84 nBTC (about $3.15 million) ended up counted as reserves in Osmosis's Alloyed BTC (allBTC) pool, leaving roughly 36% of allBTC unbacked. The gap went unnoticed for about 74 days, until Nomic halted around September 7 and a backing check exposed it.
Osmosis said its own contracts and the IBC protocol were not compromised; the bug was in Nomic's forwarding logic. On September 9, Osmosis paused allBTC minting, redemptions and Nomic-related flows, and validators ran an emergency upgrade that froze 22.65 BTC in the attacker's Osmosis account. Protos reported the attacker had already cashed out about $1 million, sending 671 ETH to Tornado Cash. Osmosis proposed a governance vote to seize the frozen 22.65 BTC and cover the remaining shortfall of about 17.19 BTC from community pool BTC reserves to restore 1:1 backing.
How it happened
- The attacker built a Nomic transaction with 25 identical IBC transfers that abused a flaw in Nomic's custom forwarding mechanism to spend the same nBTC more than once.
- The duplicated transfers delivered 40.650602 nBTC vouchers to Osmosis with no BTC locked on Nomic.
- 39.84 nBTC ended up in the allBTC transmuter, where it counted as collateral, leaving about 36% of allBTC unbacked.
- The attacker held allBTC-linked funds on Osmosis. 22.65 BTC of it was still there when Osmosis froze it on September 9.
Protocol details
Evidence
- report @osmosis incident report x.com
- report @coinminutes_en incident report x.com
- analysis DeFiLlama defillama.com
- analysis Osmosis took 74 days to discover 40-BTC Nomic exploit protos.com
- analysis Osmosis freezes 22.65 BTC after Nomic forwarding bug compromises Bitcoin reserves cryptoslate.com
- analysis Osmosis Freezes 22.65 Bitcoin After a Nomic Bug Drained allBTC's Backing startupfortune.com
- analysis Osmosis Freezes 22.65 BTC After Nomic Exploit Hits Alloyed BTC Backing cryptotimes.io
- analysis Osmosis pauses operations after Nomic Chain nBTC exploit freezes 22.65 BTC cryptobriefing.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
